ci: run as much of release workflow as possible in PRs

[auxesis]

Currently we don't automatically test changes to the release workflow in PRs. This means we have to contort our PRs to test changes (by committing new triggers, then rewriting commit history to edit them out), or trigger several releases to test changes to the release workflow (essentially testing in prod).

This PR runs as much of the release workflow as possible in PRs, without publishing the final image to Docker Hub.

It also:

• Adds comments in workflows explaining the intention of each job trigger
• Locks version of cargo-binstall to one that builds (1.17.4 currently erroring at compilation time)
• Upgrades mise in CI
• Switches back to GitHub runner for arm64 (undoing ci: Run release jobs on Blacksmith #357), as the GitHub Actions arm64 runners are reliably several minutes faster

Acknowledgment

By submitting this pull request, I confirm that CipherStash can use, modify, copy, and redistribute this contribution, under the terms of CipherStash's choice.

[Copilot]

Pull request overview

This PR enables testing of the release workflow in pull requests by adding a pull_request trigger that activates when changes are made to the workflow file itself. It introduces conditional logic to run the workflow in "dry-run" mode for PRs, preventing the final multi-platform image manifest from being published to Docker Hub while still exercising most of the workflow steps.

Changes:

• Added pull_request trigger for changes to the release workflow file
• Added conditional DRY_RUN environment variable to skip publishing the manifest in PR mode
• Added conditional execution for image inspection and Multitudes notification steps to only run on actual releases

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The function name case is not valid in GitHub Actions expressions. The correct function name is if. This line should use the ternary-like syntax: if(condition, value_if_true, value_if_false).

The expression should be:
${{ if(contains(fromJSON('["push", "release"]'), github.event_name), '', '--dry-run') }}

Without this fix, the workflow will fail when it tries to evaluate this expression.

Suggested change

	DRY_RUN: ${{ case(contains(fromJSON('["push", "release"]'), github.event_name),"", "--dry-run") }} # run the `docker buildx` command with --dry-run if we're not publishing a release
	DRY_RUN: ${{ if(contains(fromJSON('["push", "release"]'), github.event_name), '', '--dry-run') }} # run the `docker buildx` command with --dry-run if we're not publishing a release

[auxesis]

Embarrassingly wrong.